v0.28.3

This release is another proxy workaround release. Acton now keeps one more
dependency path away from Zig's own fetcher because Zig still cannot reliably
fetch HTTPS archives through an HTTP CONNECT proxy.

Packages & Distribution

• Pre-seed Zig's package cache for transitive .url dependencies declared by
  path-based Zig packages in build.zig.zon, using Acton's proxy-aware HTTP
  downloader instead of letting Zig fetch those archives during final
  compilation. [#2970]
  • This covers Acton package dependencies such as acton-zlib that carry a
    local Zig package whose own manifest pulls a source archive like
    zlib_upstream; previously acton fetch could succeed through the proxy
    and then acton build still failed later when Zig tried to resolve the
    nested archive itself.
  • The workaround is intentionally boring: parse enough ZON to find dependency
    url, hash, path, and lazy fields, follow local path deps, seed
    non-lazy remote archives into the same Zig cache, and avoid cycles or
    duplicate downloads.
  • We only need this because Zig's CONNECT proxy support is still broken for
    this path: it sends an absolute-form request URI inside the tunnel and the
    origin closes the connection, typically surfacing as invalid HTTP response: HttpConnectionClosing.
  • The proxy regression harness now builds a project that depends on a real
    Acton package with a transitive Zig dependency, so proxy-only networks cover
    the frustrating "fetch succeeded, final compile failed anyway" case.